CVE-2021-23890

MEDIUM

McAfee ePolicy Orchestrator < 5.10 Update 10 - Unauthenticated Information Disclosure via Agent Handler

Title source: llm
STIX 2.1

Description

Information leak vulnerability in the Agent Handler of McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows an unauthenticated user to download McAfee product packages (specifically McAfee Agent) available in ePO repository and install them on their own machines to have it managed and then in turn get policy details from the ePO server. This can only happen when the ePO Agent Handler is installed in a Demilitarized Zone (DMZ) to service machines not connected to the network through a VPN.

References (1)

Core 1
Core References

Scores

CVSS v3 6.5
EPSS 0.0097
EPSS Percentile 76.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Details

CWE
CWE-200
Status published
Products (2)
mcafee/epolicy_orchestrator 5.10.0 (10 CPE variants)
mcafee/epolicy_orchestrator < 5.9.1
Published Mar 26, 2021
Tracked Since Feb 18, 2026